ModSecurity, an open source web application firewall engine, contains an integer underflow vulnerability (CWE-191) in libmodsecurity3 affecting versions from 3.0.0 to before 3.0.15. This vulnerability triggers an unhandled std::out_of_range exception when an administrator uses any of the rules @verifySSN, @verifyCPF, or @verifySVNR. The vulnerability is resolved in version 3.0.15. The CVSS 4.0 score of 8.2 reflects a high severity with network attack vector, low attack complexity, and no privileges or user interaction required. No vendor advisory or patch link is provided, but the fixed version is clearly identified.

Successful exploitation causes an unhandled exception due to unsigned integer underflow, potentially leading to denial of service or application instability in ModSecurity. The vulnerability does not require privileges or user interaction and can be triggered remotely via crafted rules. No known exploits in the wild have been reported.

Upgrade ModSecurity to version 3.0.15 or later, where this vulnerability is fixed. Since no official vendor advisory or patch link is provided, rely on the version upgrade as the remediation. Patch status is confirmed by the version fix information. No additional mitigation steps are indicated.